Acceptable Use Policy

This is the document that lets us switch off a site that is harming other people. It is deliberately specific.

Never, and this list is not exhaustive

• Sending unsolicited bulk email, or hosting any part of a spam operation.
• Phishing, credential harvesting, or impersonating a person, bank, government or company.
• Distributing malware, exploit kits, ransomware, or command-and-control infrastructure.
• Cryptocurrency mining, or any workload whose purpose is consuming CPU rather than serving a site.
• Originating or coordinating denial-of-service attacks, port scanning, or intrusion attempts.
• Publishing material that infringes copyright, trade mark or other rights.
• Child sexual abuse material. Reported to the authorities immediately, no notice, no appeal.
• Content that is illegal in Malta or in the country it targets.
• Open mail relays, open proxies, open DNS resolvers, or anonymising exit nodes.
• Reselling the hosting to third parties without our written agreement.
• Bulk file storage, media distribution, or backup dumping. This is website hosting.

Resource limits, as numbers

One WordPress site per subscription. Shared infrastructure means a single site that consumes disproportionate CPU, memory, disk I/O or bandwidth will be throttled and then suspended if it does not come back within limits. We will always tell you first where there is time to.

What we do about it

• Minor or accidental: we email you and give you time to fix it.
• Active harm to others, for example live phishing or outbound spam: we contain it immediately, then tell you. Containment for the most serious categories is automated and runs at any hour.
• Repeat or deliberate: termination, and we keep the right to refuse service again.

Automated containment, and what it costs you when we get it wrong

Some abuse reports carry deadlines measured in hours, and we are a small company with nobody on call overnight. So for the most serious categories a machine acts without waiting for a person: it either blocks outbound traffic from your site, or makes your site unreachable. Both are reversible, and we choose the narrower one where the harm allows it.

This will occasionally hit a site that did nothing wrong. We would rather say that plainly than pretend otherwise. When it happens you get, at the same time as the action:

• A notice saying exactly what we did, how long it lasts, where it applies, the facts we relied on, whether a person or a machine decided it, and which law or which clause of this policy we used.
• A reference number and an address to appeal to. We answer appeals on the next working morning, and if we were wrong we undo it and say so.

Two things we deliberately do not automate. Copyright complaints are always read by a person during working hours, because they turn on questions of licence and ownership that no rule can settle and because complaints of this kind are often mistaken. And a report too vague to identify what is actually wrong is not acted on automatically at all; we go back to whoever sent it and ask for specifics.

Report a breach to abuse@borgohost.com.